Hi,
I have bar chart powered by a query that uses an eval case pattern to group events into apps. e.g.,
index=blah
NOT "*test*"
NOT "*exe*"
Level=Error
| eval AppName = case(
(SourceName="Foo" AND Message="*Bar*"), "app1",
(SourceName="Foo"), "app2",
(source="Mtn" AND 'Properties.Service'="Barf"), "app3",
(SourceName="Whatever" AND match(_raw, ".*Service = OtherThing.*")), "app4",
)
| stats count as ErrorCount by AppName
What I'd like to do is have each bar, when clicked, open a new window that shows the events corresponding to the app. e.g., for the above example, the queries would be:
index=blah
NOT "*test*"
NOT "*exe*"
Level=Error
(SourceName="Foo" AND Message="*Bar*")
index=blah
NOT "*test*"
NOT "*exe*"
Level=Error
(SourceName="Foo")
index=blah
NOT "*test*"
NOT "*exe*"
Level=Error
(source="Mtn" AND 'Properties.Service'="Barf")
index=blah
NOT "*test*"
NOT "*exe*"
Level=Error
(SourceName="Whatever" AND match(_raw, ".*Service = OtherThing.*"))
The problem I am having is how to make the drilldown xml node function thusly. I thought I could use conditional tokens, but when condition nodes are in the drilldown node, I get an error saying "link cannot be condition", even though the link node is the last sibling of all the condition nodes.
Please help!
Thanks,
Orion
